Sajjad Mahessar Good Merch Group Free audit
~/sajjad $ cat projects/security-workforce ← cd ../projects Client work

Workforce & compliance system for a security company

Live · Sept 2026ISO 9001

An internal web system for a manned-guarding company: officer records, licence and vetting compliance, sites, rotas, timesheets, invoicing with VAT, subcontractor accounts in both directions, and the company’s ISO 9001 quality records — in one place, with expiries flagged before they become a problem on site.

Type
Client system
Category
Client work
Built with
JavaScript · Supabase · PostgreSQL · Row-level security · TOTP two-step
Project
8 of 37
WARNINGS · WITHIN 90 DAYS SIA LICENCE EXPIRED OR EXPIRING ACTIVE OFFICER · NO LICENCE ON FILE BS 7858 VETTING NOT COMPLETED RIGHT TO WORK EXPIRING TRAINING CERTIFICATES EXPIRING WORKING-TIME FLAGS RAISED FROM THE ROTA
The front page is what will go wrong next, not a list of everyone

What it covers

  • Officers: profiles, SIA licences, BS 7858 vetting, right to work and training certificates, each with an expiry the system watches.
  • Sites and rota: who is where, when, with working-time flags raised from the rota itself.
  • Timesheets: pre-filled from the rota, plus printable paper sign-in sheets per site for venues where a tablet isn’t practical.
  • Invoices: numbered, drafted and issued with VAT, with company and bank details printed on them.
  • Weekly summary: shifts, hours and pay by site and by officer.

Subcontracting, which is how the industry actually works

Security firms routinely staff each other’s contracts. This company supplies officers to venues other firms have won, and uses other firms’ officers on its own sites. Most off-the-shelf tools model one direction at best.

Both directions are tracked separately — hours and shifts per firm, invoices paid and unpaid, profit per firm, and a statement export — with VAT switchable per subcontractor, because not every small firm is registered.

ISO 9001 inside the system

The company holds ISO 9001. Its quality manual, procedures, live registers, records, corrective-action forms and external audit evidence were rebuilt into a structured upload pack and given a home in the system, alongside the operational data the auditor actually samples.

The evidence for an audit lives next to the work it evidences, instead of in a folder someone has to remember to update before the surveillance visit.

Access

  • Internal only — four administrator logins and no officer, site or client access, by design.
  • Two-step login on the master account, which is the one that can add and remove everyone else.
  • An audit log of changes, and its own isolated database rather than sharing one with any other system.
  • A tenders area is scaffolded and marked as coming soon, rather than shipped half-built.
Web app

Multi-company HR system

One HR system for five companies

JavaScriptSupabasePostgreSQL + RLSTOTP two-step
No charge

I’ll find the money before you pay me anything.

Send me your software subscriptions and I’ll come back with what’s replaceable and what it’s worth — free, and yours to keep either way. How it works →

Contact

Want the same done to your cost base?

Open to operations, automation and technical operations roles — and to talking with anyone running a multi-site business who suspects they're paying for software they could own instead.